Striking the balance: privacy protection and data accessibility in critical care research

We appreciate the scholarly attention that our communication and the Salzburg Intensive Care database (SICdb) have received, as demonstrated by the correspondence from Thoral and Elbers [1, 2].

We would like to extend our congratulations to the authors for their creation of AmsterdamUMCdb and their previous publications on the regulatory challenges of sharing intensive care databases within the context of Regulation (EU) 2016/679, the European General Data Protection Regulation (GDPR) [3]. The preliminary strategizing, establishment of a legal structure, and intensive debates greatly facilitated the conception of the SICdb [4].

For a large critical care dataset, achieving full anonymization without the theoretical possibility to identify subjects with a critical piece of information based on technical deidentification measures is mathematically not feasible without significantly compromising its scientific value. The widespread use of k-anonymity and l-diversity naturally decreases the granularity of the data [5]. In the case of AmsterdamUMCdb, k-anonymity and l-diversity were applied to a limited set of parameters [4]. Ideally, no individual value nor any combination of parameters should be unique. Given the scale and magnitude of individual values within a comprehensive critical care dataset, avoiding any uniqueness becomes impossible or would make the dataset useless. However, both SICdb and AmsterdamUMCdb may still be considered anonymous from a sole legal standpoint. According to recital 26 of the GDPR, the term anonymous refers to information that is processed in such a manner that data subjects are no longer identifiable. The recital further states that to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as the costs of and the amount of time required for identification. For both, SICdb and AmsterdamUMCdb, multiple state-of-the-art safety measures have been implemented to technically reduce the risk of reidentification. Additionally, strict safeguards were defined, which is true for both databases. These safeguards include a proof of research, ethics and compliance training, and requires legitimate interests of the end user, which is solely limited to medical research. As a result, the likelihood of reidentification is deemed to be remote. Consequently, SICdb can be considered fully anonymous and compliant with GDPR.

That being said, it should be noted that deidentification will not exempt researchers from the ambit and principles of the GDPR altogether, in which we fully agree with Thoral and Elbers. The GDPR ultimately also reminds every individual researcher that they are working with large numbers of data related to individual patients, which must be treated with the utmost care at all times.

In light of the accelerating pace of data science and artificial intelligence, the importance of responsible sharing of intensive care data is likely to heighten. This paradigm shift ushers in significant technical, legal, and ethical challenges and responsibilities. As such, we would greatly advocate for a cooperative initiative amongst European medical, legal, and patient communities to deliver additional guidance on responsible medical data sharing practices.